{"id":102350,"date":"2021-11-21T15:36:45","date_gmt":"2021-11-21T13:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim"},"modified":"2021-11-21T15:36:45","modified_gmt":"2021-11-21T13:36:45","slug":"uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-librecad-ruby-tensorflow-mailman-i-vim","title":{"rendered":"Vulnerabilitetet n\u00eb LibreCAD, Ruby, TensorFlow, Mailman dhe Vim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Disa vulnerabilitete t\u00eb zbuluara s\u00eb fundmi: <\/p>\n
\n
Tre vulnerabilitete n\u00eb sistemin e hapur t\u00eb projektimit t\u00eb automatizuar LibreCAD dhe n\u00eb bibliotek\u00ebn libdxfrw, t\u00eb cilat lejojn\u00eb iniciimin e nj\u00eb mbushjeje t\u00eb kontrolluar t\u00eb buffers dhe potencialisht arritjen e ekzekutimit t\u00eb kodit t\u00eb p\u00ebrdoruesit duke hapur skedar\u00eb t\u00eb formatit DWG dhe DXF t\u00eb dizajnuar posa\u00e7\u00ebrisht. Problemet jan\u00eb eliminuar deri tani vet\u00ebm n\u00eb form\u00ebn e patch-eve (CVE-2021-21898, CVE-2021-21899, CVE-2021-21900).\n
Vulnerabiliteti (CVE-2021-41817) n\u00eb metod\u00ebn Date.parse, e cila ofrohet n\u00eb bibliotek\u00ebn standarde t\u00eb gjuh\u00ebs Ruby. Problemet n\u00eb shprehjet e rregullta q\u00eb p\u00ebrdoren p\u00ebr analizimin e datave n\u00eb metod\u00ebn Date.parse mund t\u00eb p\u00ebrdoren p\u00ebr t\u00eb kryer sulme DoS, duke shkaktuar konsum t\u00eb konsideruesh\u00ebm t\u00eb burimeve CPU dhe shpenzim memorie gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb dizajnuara posa\u00e7\u00ebrisht.\n
Nj\u00eb vulnerabilitet n\u00eb platform\u00ebn e m\u00ebsimit t\u00eb makineris\u00eb TensorFlow (CVE-2021-41228), i cili lejon ekzekutimin e kodit tuaj gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb d\u00ebrguara nga sulmuesi p\u00ebrmes parametrin «—input_examples». Problemi shkaktohet nga p\u00ebrdorimi i t\u00eb dh\u00ebnave t\u00eb jashtme gjat\u00eb thirrjes s\u00eb kodit nga funksioni «eval». Problemi \u00ebsht\u00eb zgjidhur n\u00eb versionet TensorFlow 2.7.0, TensorFlow 2.6.1, TensorFlow 2.5.2 dhe TensorFlow 2.4.4.\n
Vulnerabiliteti (CVE-2021-43331) n\u00eb sistemin e menaxhimit t\u00eb sh\u00ebrbimeve t\u00eb post\u00ebs GNU Mailman, i shkaktuar nga p\u00ebrpunimi i pasakt\u00eb i disa llojeve t\u00eb URL-ve. Problemi lejon organizimin e ekzekutimit t\u00eb kodit JavaScript p\u00ebrmes caktimit t\u00eb nj\u00eb URL-je t\u00eb dizajnuar posa\u00e7\u00ebrisht n\u00eb faqen e caktimit. Nj\u00eb tjet\u00ebr problem \u00ebsht\u00eb identifikuar gjithashtu n\u00eb Mailman (CVE-2021-43332), q\u00eb lejon nj\u00eb p\u00ebrdorues me t\u00eb drejta moderatori t\u00eb gjej\u00eb fjal\u00ebkalimin e administratorit. Problemet jan\u00eb eliminuar n\u00eb l\u00ebshimin Mailman 2.1.36.\n
Nj\u00eb seri vulnerabilitetesh n\u00eb redaktorin e tekstit Vim, t\u00eb cilat mund t\u00eb \u00e7ojn\u00eb n\u00eb mbushjen e buferit dhe potencialisht n\u00eb ekzekutimin e kodit nga sulmuesi kur hapen skedar\u00eb t\u00eb formatuar posa\u00e7\u00ebrisht p\u00ebrmes opsionit «-S» (CVE-2021-3903, CVE-2021-3872, CVE-2021-3927, CVE-2021-3928, rregullimet — 1, 2, 3, 4). <\/ul>\n